Prefer Using Managed Identities For Workloads
More Info:
IAM roles for service accounts (IRSA) and EKS Pod Identity eliminate the need for developers to manage credentials. Either mechanism gives a workload its own IAM identity, so it authenticates to AWS APIs with short-lived credentials instead of long-lived access keys. Workloads without one fall back to the node instance role and inherit every permission granted to the node group.
Risk Level
High
Address
Security
Compliance Standards
CISEKS